If your box is running firmware version *.18 (~September 2012) up to *.22:
The config file comes in "CFG5" format, you can use this great tool by Hanno 'hph' Heinrichs. Usage instructions, feedback and further discussions (in German) can be found here.

If your box is running firmware 1.01.23b or newer:
1. Firmware 1.01.23b introduced the new config file format "OBC6".
2. The webinterface censors PPPoE and VoIP login data from the configuration backup file. Though you can still decrypt decrypt it.
3. If you want to extract your PPPoE/VoIP data, you need to dump the config directly from the flash as described here (English) and here (German).
4. The (static) root password is also censored by the webserver. You can still extract, if you dump the flash as described in step 2.

Serial link

Hooking up to the serial with 115200/8N1 enables you to access the brnboot bootloader and save or overwrite the flash contents along with the option to change some settings like MAC address and serial number. You have to enter three spaces immediately after powerup and then enter one exclamation mark (!) to get to the more advanced "Administrator menu".

Booting the router with serial attached leads to many, many messages and finally to a prompt

The needed password can be recovered from the decrypted config. Search for "root", the cryptic string some NUL bytes later is the PIN. We are presented with a "Debug Console" with various very low-level options:

Please note that area/partition "[8] Flash Image" is the complete flash, so do never try to erase or reflash this area. Also don't try to mess with areas 0 and 7 as you might brick your device otherwise.

Create firmware image for brnboot

WARNING: This is work in progress, so be careful and only try this out if you know what you are doing!

The router comes with the brnboot bootloader, which can boot either Code Image 0 (0xB0090000) or Code Image 1 (0xB0440000), if they are signed and obfuscated correctly (see below). The bootloader checks both locations, and the default image can be set in the brnboot menu via the UART interface.
This means that we can store the kernel image at 0xB0440000, and that we can use the area from 0xB0020000 to 0xB043FFFF (4224 KiB) for JFFS2.

By using the existing brnboot instead of u-boot, we avoid the risk of bricking the device. brnboot is accessible via the serial interface, but it also offers a recovery web interface on http://192.168.1.1/ when it doesn't find a valid code image in any of the two "Code Image" sections in flash.

Valid code image means that the code image must be " encrypted" and " signed" ( obfuscated) with two model/firmware specific keys. On my Alice IAD4421, these keys can be found in the "Boot" section of the flash at 0xB001FBEC (4 byte value "0x7AB7ADAD") and at 0xB001FC00 (null-terminated ASCII string "BRNDA4421").

With these keys, the OpenWRT build environment can create us a kernel image (vmlinux-ARV7506PW11-brn.lzma) that can be booted by brnboot if it is flashed into one of the two "Code Image" sections in flash.

WARNING: Do not overwrite the sections "Boot" (0xB0000000 to 0xB001FFFF) or "Boot Params" (0xB07F0000 to 0xB07FFFFF) or you may brick your device!